What is the CVSS score of CVE-2026-10998?

CVE-2026-10998 has a CVSS 3.1 base score of 4.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10998?

Yes, a patch is available for CVE-2026-10998. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10998

EUVD-2026-34447 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-c56g-7jpj-c99g

Information Disclosure Google Buffer Overflow Red Hat Suse Chrome

4.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.0 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SUSE

3.1 LOW

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 12:29 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

4.0 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.0

DescriptionCVE.org

Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of bounds memory read via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory read in Chrome's Media component allows a local-network-adjacent attacker to leak partial memory contents via specially crafted network traffic. Affects all Chrome releases prior to 149.0.7827.53 on desktop platforms, as confirmed by Google's stable channel advisory. No public exploit code exists and no active exploitation has been identified; SSVC assessment rates technical impact as partial with exploitation status none, placing this in a lower-priority remediation tier despite the unauthenticated vector.

Technical ContextAI

The vulnerability resides in the Media subsystem of the Chromium rendering engine, responsible for parsing and processing audio/video content and related network streams. CWE-125 (Out-of-Bounds Read) indicates that a buffer boundary check is absent or insufficient when handling attacker-controlled network data, allowing a read operation to access memory beyond the intended allocation. This class of flaw in media parsers is commonly triggered by malformed container headers, codec-specific data fields, or stream metadata. The affected CPE scope covers Chrome prior to version 149.0.7827.53 (EUVD: EUVD-2026-34447). Chromium rated this Medium severity internally, consistent with the limited confidentiality-only impact and constrained attack vector.

RemediationAI

The vendor-released patch is Chrome 149.0.7827.53, available via the Google stable channel update published at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Users and enterprise administrators should update to 149.0.7827.53 or later immediately through Chrome's built-in update mechanism or via managed deployment tooling. As an interim compensating control, restricting Chrome usage on untrusted network segments (e.g., public Wi-Fi, guest VLANs) reduces exposure to the local-network attack vector described in the advisory. Disabling or sandboxing media playback features in enterprise policy (via Chrome's ExtensionSettings or media-related policy flags) could further limit attack surface, though this may degrade legitimate media functionality. No workaround fully substitutes for the patch given the unauthenticated, zero-interaction nature of the vector.